Gold, Temples, and a Manufactured Panic - How Rumours Outran Official Clarifications
Introduction
By the morning of May 19, 2026, many Indians woke up to see a worrying message being circulated on WhatsApp and X (formerly Twitter) stating that the government proposed to appropriate all gold stored in the temples, convert it to cash by some new scheme, and further, regard temple towers, doors, etc., gilded with gold as the "Strategic Gold Reserves of India." The panic spread immediately; religious communities were enraged, and online arguments broke out. By afternoon, the rumour was out of control. The catch was that this whole thing was false.
The Rise of Misinformation: An Old Problem with a New Engine
Misinformation is an ancient phenomenon. Folk scholars have observed for centuries that fabrications, rumours, and hoaxes move through the same channels and follow the same patterns as reliable news, deriving their credibility from repetition rather than proof and relying on social networks for believability.
A seminal 2017 study published in the Journal of Economic Perspectives by Allcott and Gentzkow discovered that fake news articles were far more widely shared than the most popular legitimate news articles in the run-up to the 2016 United States presidential election. The study additionally discovered that nearly 62% of all American adults get at least a fraction of their news through social media, a reality the researchers posited would allow fake news to spread wide and far through unvetted channels.
India is an even more extreme case; on a platform such as WhatsApp, where researcher Kiran Garimella, working for MIT, estimates that 50 billion messages are transmitted every single day in India alone, misinformation is less something that spreads and more something that simply exists.
The Science of Viral Misinformation
The temple gold rumour took a course typical of conspiracy theories. A dramatic, provocative rumour that simultaneously appealed to religious, state, and financial safety was received by an audience already conditioned to mistrust its leaders. In Science, 2018, MIT researchers Vosoughi, Roy, and Aral mapped the very mechanism at scale: it revealed false information to propagate about six times more than true information, reaching about three times as many people. The study further concluded that falsehoods were 70% more likely to be shared than true stories and that the 'engine' of false information spread was not bots and algorithms but humans. The simple reason was that humans prefer something that is novel, surprising, and alarming.
Pariser further elaborated this process within his book Filter Bubble; as algorithms mainly show users what conforms with their existing beliefs, people are put in individual echo chambers, and their tendency to share emotional or falsified content results in corrections often failing to keep up.
The Importance of Fact-Checking and Official Sources
The government reacted to this with a swift and concise response, and an official statement released by the Ministry of Finance on 19 May 2026 cautioned citizens that all legal government policies are declared only through official press releases, government websites, and appropriate agencies and not via social media forwards.
India has a dedicated institutional resource for exactly this purpose. The PIB Fact Check Unit (FCU), established in November 2019 under the Press Information Bureau, has now published over 2,900 fact-checks covering false claims about government policies, schemes, deepfakes, AI-generated content, fabricated notifications, and fraudulent websites. Citizens can submit suspicious content directly to the FCU via WhatsApp (+91 8799711259) or through factcheck.pib.gov.in: The service is free, confidential, and designed to be accessible.
The Risks of Sharing Unverified Information
Beyond confusion and unnecessary anxiety, the spread of unverified information carries concrete risks. Allcott and Gentzkow's research found that individuals who consumed more ideologically homogeneous information were substantially more likely to believe false headlines, a pattern that holds regardless of education or political affiliation.
In India, where WhatsApp research has documented that approximately 13% of images shared in politically active groups constitute known misinformation, the consequences have at times extended well beyond digital confusion.
Advisory for Citizens: Verify, Inoculate, and Share Responsibly
Becoming responsible digital citizens is more than just exercising passive vigilance. An important concept every digital citizen ought to know was formulated by John Cook, Stephan Lewandowsky, and Ullrich Ecker in a 2017 PLOS ONE paper: it is called "prebunking."
Debunking seeks to counter a falsehood once it is believed, while prebunking builds resilience in advance of the exposure, similar to how a vaccine inoculates the body to protect against a disease. Prebunking is implemented through an inoculation technique wherein individuals are warned about the presence of likely future misinformation, about the subject and the typical manipulative tactics that the misinformation may use. Exposure, even in an attenuated form, arms individuals with the wherewithal to recognise and disregard the actual misinformation once it appears. What this means in practice is that informed, aware citizens, capable of analysing how misinformation is crafted, are unlikely to fall for a new rumour of this nature.
What should be kept in mind?
- Wait before sharing: A prompt sense of fear, anger, or desire to share a post is not a call to immediate dissemination but an exercise in caution.
- Prebunk yourself and others: Be mindful of subjects that persistently generate falsehoods like government schemes, religious matters, economic policy, and national security.
- Refer to official sources only: The authenticity of claims related to any government scheme can be cross-checked on PIB.gov.in, relevant ministries, or the PIB Fact Check WhatsApp number, 8799711259.
- Identify filter bubbles: Repeated confirmation of your own beliefs and concerns indicates an algorithmic bubble.
- Do not amplify ambiguity: Circulating information merely as a matter of cautious verification has damaging repercussions.
- Rectify what has been shared: Issue the correction to the same recipients as the false information.
Conclusion
The swift clarifications issued by the government in May 2026 and fact-check systems by PIB have helped contain the panic, but the role of the government cannot be seen as the sole bulwark against misinformation. An informed citizenry, digitally and information literate to such an extent that they know how misinformation is created and circulated, is our strongest defence against fake news. It is not only the ability to fact-check but also to detect manipulative attempts before misinformation goes viral. Check before you share. Stop before you panic. When in doubt, check the PIB Fact Check.
References
[3] https://www.pib.gov.in/PressReleasePage.aspx?PRID=2247720
[4] Allcott, Hunt and Matthew Gentzkow. (2017). "Social Media and Fake News in the 2016 Election." Journal of Economic Perspectives 31(2): 211–23
[5] Vosoughi, Soroush, Deb Roy, and Sinan Aral. (2018). "The Spread of True and False News Online." Science 359(6380): 1146–1151
[6] Cook, John, Stephan Lewandowsky, and Ullrich K. H. Ecker. (2017). "Neutralizing misinformation through inoculation: Exposing misleading argumentation techniques reduces their influence." PLOS ONE 12(5): e0175799.
[7] Garimella, Kiran and Dean Eckles. (2020/2023). "Images and Misinformation in Political Groups: Evidence from WhatsApp in India.
[8] Christakis, Nicholas A. and James H. Fowler. (2011). Connected: The Surprising Power of Our Social Networks and How They Shape Our Lives.
[9] Pariser, Eli. (2011/2012). The Filter Bubble: What the Internet Is Hiding from You.
Related Blogs
.webp)
Introduction
In an era where organisations are increasingly interdependent through global supply chains, outsourcing and digital ecosystems, third-party risk has become one of the most vital aspects of enterprise risk management. The SolarWinds hack, the MOVEit vulnerabilities and recent software vendor attacks all serve as a reminder of the necessity to enhance Third-Party Risk Management (TPRM). As cyber risks evolve and become more sophisticated and as regulatory oversight sharpens globally, 2025 is a transformative year for the development of TPRM practices. This blog explores the top trends redefining TPRM in 2025, encompassing real-time risk scoring, AI-driven due diligence, harmonisation of regulations, integration of ESG, and a shift towards continuous monitoring. All of these trends signal a larger movement towards resilience, openness and anticipatory defence in an increasingly dependent world.
Real-Time and Continuous Monitoring becomes the Norm
The old TPRM methods entailed point-in-time testing, which typically was an annual or onboarding process. By 2025, organisations are shifting towards continuous, real-time monitoring of their third-party ecosystems. Now, authentic advanced tools are making it possible for companies to take a real-time pulse of the security of their vendors by monitoring threat indicators, patching practices and digital footprint variations. This change has been further spurred by the growth in cyber supply chain attacks, where the attackers target vendors to gain access to bigger organisations. Real-time monitoring software enables the timely detection of malicious activity, equipping organisations with a faster defence response. It also guarantees dynamic risk rating instead of relying on outdated questionnaire-based scoring.
AI and Automation in Risk Assessment and Due Diligence
Manual TPRM processes aren't sustainable anymore. In 2025, AI and machine learning are reshaping the TPRM lifecycle from onboarding and risk classification to contract review and incident handling. AI technology can now analyse massive amounts of vendor documentation and automatically raise red flags on potential issues. Natural language processing (NLP) is becoming more common for automated contract intelligence, which assists in the detection of risky clauses or liability gaps or data protection obligations. In addition, automation is increasing scalability for large organisations that have hundreds or thousands of third-party relationships, eliminating human errors and compliance fatigue. However, all of this must be implemented with a strong focus on security, transparency, and ethical AI use to ensure that sensitive vendor and organisational data remains protected throughout the process.
Risk Quantification and Business Impact Mapping
Risk scoring in isolation is no longer adequate. One of the major trends for 2025 is the merging of third-party risk with business impact analysis (BIA). Organisations are using tools that associate vendors to particular business processes and assets, allowing better knowledge of how a compromise of a vendor would impact operations, customer information or financial position. This movement has resulted in increased use of risk quantification models, such as FAIR (Factor Analysis of Information Risk), which puts dollar values on risks associated with vendors. By using the language of business value, CISOs and risk officers are more effective at prioritising risks and making resource allocations.
Environmental, Social, and Governance (ESG) enters into TPRM
As ESG keeps growing on the corporate agenda, organisations are taking TPRM one step further than cybersecurity and legal risks and expanding it to incorporate ESG-related factors. In 2025, organisations evaluate if their suppliers have ethical labour practices, sustainable supply chains, DEI (Diversity, Equity, Inclusion) metrics and climate impact disclosures. This growth is not only a reputational concern, but also a third-party non-compliance with ESG can now invoke regulatory or shareholder action. ESG risk scoring software and vendor ESG audits are becoming components of onboarding and performance evaluations.
Shared Assessments and Third-Party Exchanges
With the duplication of effort by having multiple vendors respond to the same security questionnaires, the trend is moving toward shared assessments. Systems such as the SIG Questionnaire (Standardised Information Gathering) and the Global Vendor Exchange allow vendors to upload once and share with many clients. This change not only simplifies the due diligence process but also enhances data accuracy, standardisation and vendor experience. In 2025, organisations are relying more and more on industry-wide vendor assurance platforms to minimise duplication, decrease costs and maximise trust.
Incident Response and Resilience Partnerships
Another trend on the rise is bringing vendors into incident response planning. In 2025, proactive organisations address major vendors as more than suppliers but as resilience partners. This encompasses shared tabletop exercises, communication procedures and breach notification SLAs. With the increasing ransomware attacks and cloud reliance, organisations are now calling for vendor-side recovery plans, RTO and RPO metrics. TPRM is transforming into a comprehensive resilience management function where readiness and not mere compliance takes centre stage.
Conclusion
Third-Party Risk Management in 2025 is no longer about checklists and compliance audits; it's a dynamic, intelligence-driven and continuous process. With regulatory alignment, AI automation, real-time monitoring, ESG integration and resilience partnerships leading the way, organisations are transforming their TPRM programs to address contemporary threat landscapes. As digital ecosystems grow increasingly complex and interdependent, managing third-party risk is now essential. Early adopters who invest in tools, talent and governance will be more likely to create secure and resilient businesses for the AI era.
References
- https://finance.ec.europa.eu/publications/digital-operational-resilience-act-dora_en
- https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
- https://www.meity.gov.in/data-protection-framework
- https://securityscorecard.com
- https://sharedassessments.org/sig/
- https://www.fairinstitute.org/fair-model
Introduction
In the boundless world of the internet—a digital frontier rife with both the promise of connectivity and the peril of deception—a new spectre stealthily traverses the electronic pathways, casting a shadow of fear and uncertainty. This insidious entity, cloaked in the mantle of supposed authority, preys upon the unsuspecting populace navigating the virtual expanse. And in the heart of India's vibrant tapestry of diverse cultures and ceaseless activity, Mumbai stands out—a sprawling metropolis of dreams and dynamism, yet also the stage for a chilling saga, a cyber charade of foul play and fraud.
The city's relentless buzz and hum were punctuated by a harrowing tale that unwound within the unassuming confines of a Kharghar residence, where a 46-year-old individual's brush with this digital demon would unfold. His typical day veered into the remarkable as his laptop screen lit up with an ominous pop-up, infusing his routine with shock and dread. This deceiving popup, masquerading as an official communication from the National Crime Records Bureau (NCRB), demanded an exorbitant fine of Rs 33,850 for ostensibly browsing adult content—an offence he had not committed.
The Cyber Deception
This tale of deceit and psychological warfare is not unique, nor is it the first of its kind. It finds echoes in the tragic narrative that unfurled in September 2023, far south in the verdant land of Kerala, where a young life was tragically cut short. A 17-year-old boy from Kozhikode, caught in the snare of similar fraudulent claims of NCRB admonishment, was driven to the extreme despair of taking his own life after being coerced to dispense Rs 30,000 for visiting an unauthorised website, as the pop-up falsely alleged.
Sewn with a seam of dread and finesse, the pop-up which appeared in another recent case from Navi Mumbai, highlights the virtual tapestry of psychological manipulation, woven with threatening threads designed to entrap and frighten. In this recent incident a 46-year-old Kharghar resident was left in shock when he got a pop-up on a laptop screen warning him to pay Rs 33,850 fine for surfing a porn website. This message appeared from fake website of NCRB created to dupe people. Pronouncing that the user has engaged in browsing the Internet for some activities, it delivers an ultimatum: Pay the fine within six hours, or face the critical implications of a criminal case. The panacea it offers is simple—settle the demanded amount and the shackles on the browser shall be lifted.
It was amidst this web of lies that the man from Kharghar found himself entangled. The story, as retold by his brother, an IT professional, reveals the close brush with disaster that was narrowly averted. His brother's panicked call, and the rush of relief upon realising the scam, underscores the ruthless efficiency of these cyber predators. They leverage sophisticated deceptive tactics, even specifying convenient online payment methods to ensnare their prey into swift compliance.
A glimmer of reason pierced through the narrative as Maharashtra State cyber cell special inspector general Yashasvi Yadav illuminated the fraudulent nature of such claims. With authoritative clarity, he revealed that no legitimate government agency would solicit fines in such an underhanded fashion. Rather, official procedures involve FIRs or court trials—a structured route distant from the scaremongering of these online hoaxes.
Expert Take
Concurring with this perspective, cyber experts facsimiles. By tapping into primal fears and conjuring up grave consequences, the fraudsters follow a time-worn strategy, cloaking their ill intentions in the guise of governmental or legal authority—a phantasm of legitimacy that prompts hasty financial decisions.
To pierce the veil of this deception, D. Sivanandhan, the former Mumbai police commissioner, categorically denounced the absurdity of the hoax. With a voice tinged by experience and authority, he made it abundantly clear that the NCRB's role did not encompass the imposition of fines without due process of law—a cornerstone of justice grossly misrepresented by the scam's premise.
New Lesson
This scam, a devilish masquerade given weight by deceit, might surge with the pretence of novelty, but its underpinnings are far from new. The manufactured pop-ups that propagate across corners of the internet issue fabricated pronouncements, feigned lockdowns of browsers, and the spectre of being implicated in taboo behaviours. The elaborate ruse doesn't halt at mere declarations; it painstakingly fabricates a semblance of procedural legitimacy by preemptively setting penalties and detailing methods for immediate financial redress.
Yet another dimension of the scam further bolsters the illusion—the ominous ticking clock set for payment, endowing the fraud with an urgency that can disorient and push victims towards rash action. With a spurious 'Payment Details' section, complete with options to pay through widely accepted credit networks like Visa or MasterCard, the sham dangles the false promise of restored access, should the victim acquiesce to their demands.
Conclusion
In an era where the demarcation between illusion and reality is nebulous, the impetus for individual vigilance and scepticism is ever-critical. The collective consciousness, the shared responsibility we hold as inhabitants of the digital domain, becomes paramount to withstand the temptation of fear-inducing claims and to dispel the shadows cast by digital deception. It is only through informed caution, critical scrutiny, and a steadfast refusal to capitulate to intimidation that we may successfully unmask these virtual masquerades and safeguard the integrity of our digital existence.
References:
- https://www.onmanorama.com/news/kerala/2023/09/29/kozhikode-boy-dies-by-suicide-after-online-fraud-threatens-him-for-visiting-unauthorised-website.html
- https://timesofindia.indiatimes.com/pay-rs-33-8k-fine-for-surfing-porn-warns-fake-ncrb-pop-up-on-screen/articleshow/106610006.cms
- https://www.indiatoday.in/technology/news/story/people-who-watch-porn-receiving-a-warning-pop-up-do-not-pay-it-is-a-scam-1903829-2022-01-24
Introduction
The Ministry of Communications, Department of Telecommunications notified the Telecommunications (Telecom Cyber Security) Rules, 2024 on 22nd November 2024. These rules were notified to overcome the vulnerabilities that rapid technological advancements pose. The evolving nature of cyber threats has contributed to strengthening and enhancing telecom cyber security. These rules empower the central government to seek traffic data and any other data (other than the content of messages) from service providers.
Background Context
The Telecommunications Act of 2023 was passed by Parliament in December, receiving the President's assent and being published in the official Gazette on December 24, 2023. The act is divided into 11 chapters 62 sections and 3 schedules. The said act has repealed the old legislation viz. Indian Telegraph Act of 1885 and the Indian Wireless Telegraphy Act of 1933. The government has enforced the act in phases. Sections 1, 2, 10-30, 42-44, 46, 47, 50-58, 61, and 62 came into force on June 26, 2024. While, sections 6-8, 48, and 59(b) were notified to be effective from July 05, 2024.
These rules have been notified under the powers granted by Section 22(1) and Section 56(2)(v) of the Telecommunications Act, 2023.
Key Provisions of the Rules
These rules collectively aim to reinforce telecom cyber security and ensure the reliability of telecommunication networks and services. They are as follows:
The Central Government agency authorized by it may request traffic or other data from a telecommunication entity through the Central Government portal to safeguard and ensure telecom cyber security. In addition, the Central Govt. can instruct telecommunication entities to establish the necessary infrastructure and equipment for data collection, processing, and storage from designated points.
● Obligations Relating To Telecom Cybersecurity:
Telecom entities must adhere to various obligations to prevent cyber security risks. Telecommunication cyber security must not be endangered, and no one is allowed to send messages that could harm it. Misuse of telecommunication equipment such as identifiers, networks, or services is prohibited. Telecommunication entities are also required to comply with directions and standards issued by the Central Govt. and furnish detailed reports of actions taken on the government portal.
● Compulsory Measures To Be Taken By Every Telecommunication Entity:
Telecom entities must adopt and notify the Central Govt. of a telecom cyber security policy to enhance cybersecurity. They have to identify and mitigate risks of security incidents, ensure timely responses, and take appropriate measures to address such incidents and minimize their impact. Periodic telecom cyber security audits must be conducted to assess network resilience against potential threats for telecom entities. They must report security incidents promptly to the Central Govt. and establish facilities like a Security Operations Centre.
● Reporting of Security Incidents:
- Telecommunication entities must report the detection of security incidents affecting their network or services within six hours.
- 24 hours are provided for submitting detailed information about the incident, including the number of affected users, the duration, geographical scope, the impact on services, and the remedial measures implemented.
The Central Govt. may require the affected entity to provide further information, such as its cyber security policy, or conduct a security audit.
CyberPeace Policy Analysis
The notified rules reflect critical updates from their draft version, including the obligation to report incidents immediately upon awareness. This ensures greater privacy for consumers while still enabling robust cybersecurity oversight. Importantly, individuals whose telecom identifiers are suspended or disconnected due to security concerns must be given a copy of the order and a chance to appeal, ensuring procedural fairness. The notified rules have removed "traffic data" and "message content" definitions that may lead to operational ambiguities. While the rules establish a solid foundation for protecting telecom networks, they pose significant compliance challenges, particularly for smaller operators who may struggle with costs associated with audits, infrastructure, and reporting requirements.
Conclusion
The Telecom Cyber Security Rules, 2024 represent a comprehensive approach to securing India’s communication networks against cyber threats. Mandating robust cybersecurity policies, rapid incident reporting, and procedural safeguards allows the rules to balance national security with privacy and fairness. However, addressing implementation challenges through stakeholder collaboration and detailed guidelines will be key to ensuring compliance without overburdening telecom operators. With adaptive execution, these rules have the potential to enhance the resilience of India’s telecom sector and also position the country as a global leader in digital security standards.
References
● Telecommunications Act, 2023 https://acrobat.adobe.com/id/urn:aaid:sc:AP:767484b8-4d05-40b3-9c3d-30c5642c3bac
● CyberPeace First Read of the Telecommunications Act, 2023 https://www.cyberpeace.org/resources/blogs/the-government-enforces-key-sections-of-the-telecommunication-act-2023
● Telecommunications (Telecom Cyber Security) Rules, 2024
